Fossil

Differences From Artifact [5dc16b2eae]:

• File src/style.c — part of check-in [c515e5fd9f] at 2020-08-24 22:20:00 on branch misc-js-experiments — Moved C routines which emit fossil.XYZ JS APIs from style.c to builtin.c, and renamed appropriately. Added flag to output_text_with_line_numbers() to disable emit of JS (needed for fileedit preview, at a minimum). The experimental emitting of all fossil.XYZ APIs at once is now limited to bundled mode, as that's the only place it's potentially of benefit. (user: stephan size: 44185) [more...]

To Artifact [7cdb68cd36]:

• File src/style.c — part of check-in [e0f2283c15] at 2020-09-03 19:04:02 on branch trunk — Make sure that any newlines in the CSP are converted into simple spaces before the CSP is added to an HTTP header. This *might* fix a problem reported [forum:/info/d29e3af43c|on the forum]. (user: drh size: 44411)

524
525
526
527
528
529
530

531
532
533
534
535
536
537
538
539
540
541



542
543
544
545
546
547
548

524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552

+











+
+
+

   "default-src 'self' data:; "
   "script-src 'self' 'nonce-$nonce'; "
   "style-src 'self' 'unsafe-inline'";
  const char *zFormat = db_get("default-csp","");
  Blob csp;
  char *zNonce;
  char *zCsp;
  int i;
  if( zFormat[0]==0 ){
    zFormat = zBackupCSP;
  }
  blob_init(&csp, 0, 0);
  while( zFormat[0] && (zNonce = strstr(zFormat,"$nonce"))!=0 ){
    blob_append(&csp, zFormat, (int)(zNonce - zFormat));
    blob_append(&csp, style_nonce(), -1);
    zFormat = zNonce + 6;
  }
  blob_append(&csp, zFormat, -1);
  zCsp = blob_str(&csp);
  /* No whitespace other than actual space characters allowed in the CSP
  ** string.  See https://fossil-scm.org/forum/forumpost/d29e3af43c */
  for(i=0; zCsp[i]; i++){ if( fossil_isspace(zCsp[i]) ) zCsp[i] = ' '; }
  if( toHeader ){
    cgi_printf_header("Content-Security-Policy: %s\r\n", zCsp);
  }
  return zCsp;
}

/*